{"id":"CVE-2026-46023","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror: fix integer overflow in create_dirty_log()\n\nThe argument count calculation in create_dirty_log() performs\n`*args_used = 2 + param_count` before validating ag…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror: fix integer overflow in create_dirty_log()\n\nThe argument count calculation in create_dirty_log() performs\n`*args_used = 2 + param_count` before validating ag…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.12.1, < 5.10.258","linux_kernel >= 5.11, < 5.15.209","linux_kernel >= 5.16, < 6.1.175","linux_kernel >= 6.2, < 6.6.140","linux_kernel >= 6.7, < 6.12.86","linux_kernel >= 6.13, < 6.18.27","linux_kernel >= 6.19, < 7.0.4","linux_kernel = 2.6.12"],"patched":["linux_kernel 7.0.4"],"published":"2026-05-27","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:38.927","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46023","references":[{"url":"https://git.kernel.org/stable/c/17a08791d428885d00e510864283a7b839792368","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/249c831183fb806c8e3b14c7c4c1d2fb68cf37fb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35f6b3281efd44d19110574663bc17a610bc73b9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47dad9eea75d33212d3d2cea10e7ed6a1bfc0713","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c788c6f921b22f9b6c3f316c4a071c05683e7de","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87c99a50e0fdc68a5b9b52a94d49452cd3ff02ca","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae59b3025609d5a0a39cf5b2b94e2467f6231573","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5e0ae3237584ebef510366c4cb3d5cc7c22b610","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00173,"epssPercentile":0.06246,"ingestedAt":"2026-10-15T03:30:12.881Z","slug":"CVE-2026-46023","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror: fix integer overflow in create_dirty_log()\n\nThe argument count calculation in create_dirty_log() performs\n`*args_used = 2 + param_count` before validating against argc. When a\nuser provides a param_count close to UINT_MAX via the device mapper\ntable string, this unsigned addition wraps around to a small value,\ncausing the subsequent `argc < *args_used` check to be bypassed.\n\nThe overflowed param_count is then passed as argc to dm_dirty_log_create(),\nwhere it can cause out-of-bounds reads on the argv array.\n\nFix by comparing param_count against argc - 2 before performing the\naddition, following the same pattern used by parse_features() in the\nsame file. Since argc >= 2 is already guaranteed, the subtraction is\nsafe.\n\n## Affected\n\n- `linux_kernel >= 2.6.12.1, < 5.10.258`\n- `linux_kernel >= 5.11, < 5.15.209`\n- `linux_kernel >= 5.16, < 6.1.175`\n- `linux_kernel >= 6.2, < 6.6.140`\n- `linux_kernel >= 6.7, < 6.12.86`\n- `linux_kernel >= 6.13, < 6.18.27`\n- `linux_kernel >= 6.19, < 7.0.4`\n- `linux_kernel = 2.6.12`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.4`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}